huntrule

Suspicious DllHost Spawned By MMC Without Arguments via PASTALOADER

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-17
Updated
2026-09-17
AnalysisDetection

ATT&CK techniques

Priv Esc → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects dllhost.exe launched by mmc.exe with an empty or missing command line which is characteristic of the PASTALOADER stage of GrimResource where shellcode is injected into a freshly spawned dllhost.exe process. Adversaries use this sacrificial COM surrogate combined with DirtyCLR unhooking and indirect syscalls to stealthily load Cobalt Strike.

Reporting behind it

Related detections9 linkedT1055 — drag to rearrange
PowerShell In-Memory Shellcode Execution via Memory Allocation APIs (via ps_script)
Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)
Suspicious vbc.exe Spawned by Installer Process
Suspicious Office Application Spawning Script Or Shell Interpreter
Suspicious Network Connection From wabmig.exe (Turian Injection)
Suspicious Outbound Network Connection from Explorer Process
Suspicious AppLaunch.exe Spawned As Injection Target (via process_creation)
Suspicious BugSleep Marker File in Public Directory
Suspicious CRAT Injection Named Pipe ChromeUpdatePipe (via pipe_created)
Suspicious DllHost Spawned By MMC Without Arguments via PASTALOADER
Pivot detection · T1055 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.